Procedural Manual for the Election Assistance Commission's Voting System Test Laboratory Program, 50140-50172 [E8-19064]

Agencies

• Election Assistance Commission

[Federal Register Volume 73, Number 165 (Monday, August 25, 2008)]
[Notices]
[Pages 50140-50172]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: E8-19064]


-----------------------------------------------------------------------

ELECTION ASSISTANCE COMMISSION


Procedural Manual for the Election Assistance Commission's Voting 
System Test Laboratory Program

AGENCY: United States Election Assistance Commission (EAC).

ACTION: Notice; Publication of Voting System Test Laboratory Program 
Manual.

-----------------------------------------------------------------------

SUMMARY: The U.S. Election Assistance Commission (EAC) is publishing a 
procedural manual for its Voting System Test Laboratory Program. This 
program sets the administrative procedures for laboratories to obtain 
and maintain accreditation to test voting systems under the EAC's 
Voluntary Testing and Certification Program. The program is mandated by 
the Help America Vote Act (HAVA) at 42 U.S.C. 15371.

FOR FURTHER INFORMATION CONTACT: Brian Hancock, Director, Voting System 
Certification, Washington, DC, (202) 566-3100, Fax: (202) 566-1392.

SUPPLEMENTARY INFORMATION:

Background

    HAVA requires that the EAC certify and decertify voting systems 
through testing conducted by accredited laboratories. Section 231(a)(1) 
of HAVA (42 U.S.C. 15371) specifically requires the EAC to ``* * * 
provide for the testing, certification, decertification and 
recertification of voting system hardware and software by accredited 
laboratories.'' To meet this obligation, the EAC has created a 
voluntary program to test voting systems to Federal voting system 
standards by accredited laboratories. The Voting System Test Laboratory 
Program Manual sets the procedures for the test laboratories to follow 
in order to receive and maintain accreditation as well as procedures 
for the documentation and publication of testing information.
    In creating the Laboratory Manual the EAC sought input from experts 
and stakeholders. Specifically, the EAC conducted meetings with 
representatives from the voting system test laboratories and from the 
voting system manufacturing community. Additionally, the EAC sought 
input from the public. A draft version of the EAC Voting System Test 
Laboratory Program Manual was published with a request for public 
comment on February 4, 2008. (73 FR 6495). The public comment period 
was open until 5 p.m. EST on April 4, 2008. While previous notice and 
public comment period were not required by law, all comments received 
were considered in the drafting of this final administrative manual.

[[Page 50141]]

Discussion of Comments

    The EAC received thirty-eight comments from the public. The 
majority of these comments came from voting system test laboratories, 
with the remainder coming from the general public.
    The majority of comments received by the Commission raised concerns 
or questioned the meaning or application of various provisions of the 
manual. Another block of comments were less specific and focused on the 
fundamental purpose behind the program or its basic methodology. 
Comments in this category included concerns regarding the level of 
allowable participation by manufacturers in the testing process and the 
responsibilities of Voting System Test Laboratories regarding third 
party testing. Finally, there were a range of specific recommendations 
on a wide variety of topics. Examples include: (1) Changing the scope 
of core and non-core testing; (2) clarifying who is responsible for the 
validation of test methods; (3) allowing hardware mitigation by the 
manufacturer; (4) clarifying the scope of the use of prior testing in a 
testing campaign; (5) clarifying the restriction on testing at 
manufacturer owned or controlled facilities and the allowance of such 
activity in conjunction with the witness or trusted build; and (6) 
placing the responsibility for the proper identification of proprietary 
information on the manufacturer and not on the testing laboratory.
    The EAC reviewed and considered each of the comments presented. In 
doing so, it also gathered additional information and performed 
research regarding the suggestions. The EAC's commitment to public 
participation is evident in the final version of the Laboratory Manual. 
The Manual has been enhanced in a number of areas in response to public 
comment. A total of about five pages have been added to the Manual. 
Throughout the entire Manual the EAC added or amended language to 
clarify its procedures consistent with the comments it received. For 
example, to further clarify terminology used throughout the Manual 
eight terms were newly defined or significantly clarified in the 
definition section of Chapter 1. Additionally, the EAC made changes to 
clarify the independent role of Voting System Test Labs in the program, 
enhance the supervision requirements of EAC accredited laboratories 
over third party contracted laboratories, and further defined the level 
of detail required by the EAC on test plans, test cases, and test 
reports. Finally, the EAC clarified financial stability documentation 
requirements for laboratories seeking accreditation.

Thomas R. Wilkey,
Executive Director, U.S. Election Assistance Commission.
BILLING CODE 6820-KF-P

[[Page 50142]]

[GRAPHIC] [TIFF OMITTED] TN25AU08.005

BILLING CODE 6820-KF-C

[[Page 50143]]

Paperwork Reduction Act

    The reporting requirements in this manual are pending approval 
under the Paperwork Reduction Act of 1995, by the Office of Management 
and Budget Control (OMB). Persons are not required to respond to this 
collection of information unless it displays a currently valid OMB 
number. Information gathered pursuant to this document and its forms 
will be used solely to administer the EAC Testing & Certification and 
Laboratory Accreditation Program. This program is voluntary. 
Individuals who wish to participate in the program, however, must meet 
its requirements. The estimated total annual hourly burden on the 
voting system manufacturing industry and election officials is 200 
hours. This estimate includes the time required for reviewing the 
instructions, gathering information, and completing the prescribed 
forms. Send comments regarding this burden estimate or any other aspect 
of this collection, including suggestions for reducing this burden to 
the U.S. Election Assistance Commission, Voting System Testing and 
Certification Program, Office of the Program Director, 1225 New York 
Avenue, NW., Suite 1100, Washington, DC 20005.

1. Introduction
1.1. Background
1.2. Authority
1.3. Role of the National Institute of Standards and Technology
1.4. Scope
1.7. Program Personnel
1.8. Submission of Documents
1.9. Receipt of Documents--VSTL
1.10. Receipt of Documents--EAC
1.11. Record Retention--EAC
1.12. Publication and Release of Documents
1.13. References
1.14. Definitions
1.15. Acronyms and Abbreviations
2. Program Requirements
2.1. Overview
2.2. Program Requirements--Generally
2.3. NIST Recommendation
2.4. NVLAP Accreditation
2.5. Conflict of Interest and Prohibited Practices Program
2.6. Personnel Policies
2.7. Notification of Changes
2.8. Site Visits
2.9. Notice of Lawsuits
2.10. Testing, Technical Practices and Reporting
2.11. Laboratory Independence
2.12. Authority To Do Business in the United States
2.13. Communications
2.14. Resources and Financial Stability
2.15. Recordkeeping
3. Accreditation Process
3.1. Overview
3.2. NIST Recommendation
3.3. EAC Invitation
3.4. Application
3.5. EAC Review of Application Package
3.6. Grant of Accreditation
3.7. Effect of Accreditation
3.8. Expiration and Renewal of Accreditation
3.9. Denial of Accreditation
3.10. Requesting Appeal
3.11. EAC Action on a Request for Appeal
3.12. Submission of Appeal
3.13. Consideration of Appeal
3.14. Commissioner's Decision on Appeal
3.15. Effect of Denial of Accreditation
4. Compliance Management Program
4.1. Purpose
4.2. Compliance Management Program, Generally
4.3. VSTL Notification of Changes
4.4. Request for Documents and Information
4.5. On Site Laboratory Review--Generally
4.6. On Site Laboratory Review--Frequency
4.7. On Site Laboratory Review--Procedure
4.8. EAC Compliance Management Reports
4.9. Corrective Action
5. Revocation of Accreditation
5.1. Overview
5.2. Revocation Policy
5.3. Revocation--Generally
5.4. Notice of Intent to Suspend
5.5. Suspension of Accreditation
5.6. Commissioners' Decision on Revocation of Accreditation
5.7. Effect of Revocation of Accreditation
5.8. Requesting Appeal
5.9. EAC Action on a Request for Appeal
5.10. Submission of Appeal
5.11. Consideration of Appeal
5.12. Commissioner's Decision on Appeal
6. Requests for Interpretations
6.1. Overview
6.2. Policy
6.3. Requirements for Submitting a Request for Interpretation
6.4. Procedure for Submitting a Request for Interpretation
6.5. EAC Action on a Request for Interpretation
6.6. Effect of Interpretation
6.7. Library of Interpretations
7. Release of Laboratory Accreditation Program Information
7.1. Overview
7.2. EAC Policy on the Release of Certification Program Information
7.3. Trade Secrets
7.4. Privileged or Confidential Commercial Information
7.5. EAC's Responsibilities
7.6. VSTL's Responsibilities
7.7. Personal Information

Appendix A. Certification Test Plan Format and Content

Appendix B. Certification Test Report Format and Content

Appendix C. Certification of Laboratory Conditions and Practices Form

Appendix D. Specification for Reproduction and Use of the EAC

Laboratory Accreditation Logo

1. Introduction

    1.1. Background. The Federal Election Commission (FEC) adopted the 
first formal set of voluntary Federal standards for computer-based 
voting systems in January 1990. At that time, no national program or 
organization existed to test and certify such systems to the standards. 
The National Association of State Election Directors (NASED) stepped up 
to fill this void in 1994. NASED is an independent, nongovernmental 
organization of State election officials. The organization formed the 
nation's first national program to test and qualify voting systems to 
the new Federal standards. This program utilized independent 
laboratories to test voting system to voluntary Federal standards. To 
facilitate this process NASED accredited these test laboratories, which 
it referred to as Independent Test Authorities (ITA). In late 2002, 
Congress passed the Help America Vote Act of 2002 (HAVA). HAVA created 
the U.S. Election Assistance Commission (EAC) and assigned to the EAC 
the responsibility for both setting voting system standards and 
providing for the voluntary testing and certification of voting 
systems. This mandate represented the first time the Federal government 
provided for the voluntary testing, certification, and decertification 
of voting systems nationwide. In response to this HAVA requirement, the 
EAC has developed the voting system standards in the form of the 
Voluntary Voting System Guidelines (VVSG), a voting system 
certification program in the form of the Voting System Testing and 
Certification Program Manual and this document, the Voting System Test 
Laboratory Manual.
    1.2. Authority. HAVA Section 231(b) (42 U.S.C. Sec.  15371(b)) 
requires that the EAC provide for the accreditation and revocation of 
accreditation of independent, non-federal laboratories qualified to 
test voting systems to Federal standards. Generally, the EAC considers 
for accreditation those laboratories evaluated and recommend by the 
National Institute of Standards and Technology (NIST) pursuant to HAVA 
Section 231(b)(1). However, consistent with HAVA Section 231(b)(2)(B), 
the Commission may also vote to accredit laboratories outside of those 
recommended by NIST upon publication of an explanation of the reason 
for any such accreditation.
    1.3. Role of the National Institute of Standards and Technology. 
Section 231(b) (1) of HAVA requires that the National Institute of 
Standards and Technology ``conduct an evaluation of independent, non-
federal laboratories and shall submit to the Commission a list of those 
laboratories * * * to be accredited. * * *'' Additionally, HAVA Section 
231(c) requires NIST to monitor

[[Page 50144]]

and review the performance of EAC accredited laboratories. NIST has 
chosen its National Voluntary Laboratory Accreditation Program (NVLAP) 
to carry out these duties. NVLAP conducts a review of applicant 
laboratories in order to provide a measure of confidence that such 
laboratories are capable of performing testing of voting systems to 
Federal standards. Additionally, the NVLAP program monitors 
laboratories by requiring regular assessments. Laboratories are 
reviewed one year after their initial accreditation and biennially 
thereafter. The EAC has made NVLAP accreditation a requirement of its 
Laboratory Accreditation Program. However, a NVLAP accreditation is not 
an EAC accreditation. EAC is the sole Federal authority for the 
accreditation and revocation of accreditation of Voting System Test 
Laboratories (VSTL).
    1.4. Scope. This Manual provides the procedural requirements of the 
EAC voting system Laboratory Accreditation Program. Although 
participation in the program is voluntary, adherence to the program's 
procedural requirements is mandatory for participants. The procedural 
requirements of this Manual supersede any prior laboratory 
accreditation requirements issued by the EAC. This manual shall be read 
in conjunction with the EAC Voting System Testing and Certification 
Manual.
    1.5. Manual Maintenance and Revision. The Manual will be reviewed 
periodically and updated to meet the needs of the EAC, VSTLs, election 
officials, and public policy. The EAC is responsible for revising this 
document. All revisions will be made consistent with Federal law. 
Substantive input from stakeholders and the public will be sought 
whenever possible. Changes in policy requiring immediate implementation 
will be noticed via policy memoranda and will be issued to each VSTL 
and registered Manufacturers. Changes, addendums, or updated versions 
will also be posted to the EAC Web site at www.eac.gov.
    1.6. Clarification of Program Requirements and Procedures. VSTLs 
and registered Manufacturers may request clarification regarding the 
requirements and procedures set forth in this manual. Requests for 
clarification must be based upon ambiguity arising from the application 
of this manual. Hypothetical questions will not be considered. Requests 
shall be submitted to the Program Director in writing. The request 
shall clearly identify the section of the manual and issue to be 
clarified, a proposed interpretation and all relevant facts. 
Clarifications issued by the EAC will be provided to all EAC VSTLs, 
registered Manufacturers and placed on EAC's Web site.
    1.7. Program Personnel. All EAC personnel and contractors 
associated with this program will be held to the highest ethical 
standards. All agents of the EAC involved in the Accreditation Program 
will be subject to conflict-of-interest reporting and review, 
consistent with Federal law and regulation.
    1.8. Submission of Documents. Any documents submitted pursuant to 
the requirements of this Manual shall be submitted:
    1.8.1. If sent electronically, via secure e-mail or physical 
delivery of a compact disk, unless otherwise specified. The submitted 
electronic files shall be in Microsoft Word or Adobe PDF format, 
formatted to protect the document from alteration.
    1.8.2. With a proper signature when required by this Manual. 
Documents that require an authorized signature may be signed with an 
electronic representation or image of the signature of an authorized 
management representative.
    1.8.3. If sent via physical delivery, by Certified Mail 
TM (or similar means that allows tracking) to the following 
address: Testing and Certification Program Director, U.S. Election 
Assistance Commission, 1225 New York Avenue, NW., Suite 1100, 
Washington, D.C. 20005.
    1.9. Receipt of Documents--VSTL. For purposes of this Manual, a 
document, notice, or other communication is considered received by a 
VSTL upon one of the following:
    1.9.1. The actual, documented date the correspondence was received 
(either electronically or physically) at the VSTL, or
    1.9.2. If no documentation of the actual delivery date exists, the 
date of constructive receipt of the communication. For electronic 
correspondence, documents will be constructively received the day after 
the date sent. For mail correspondence, the document will be 
constructively received 3 days after the date sent.
    1.9.3. The term ``receipt'' shall mean the date a document or 
correspondence arrives (either electronically or physically) at the 
VSTL's place of business. Arrival does not require that an agent of the 
VSTL open, read, or review the correspondence.
    1.10. Receipt of Documents--EAC. For purposes of this Manual, a 
document, notice, or other communication is considered received by the 
EAC upon its physical or electronic arrival at the agency. All 
documents received by the agency will be physically or electronically 
date stamped. This stamp shall serve as the date of receipt. Documents 
received after the regular business day (5:00 PM Eastern Standard 
Time), will be treated as if received on the next business day.
    1.11. Record Retention--EAC. The EAC shall retain all records 
associated with accreditation of Voting System Test Laboratories. The 
records shall otherwise be retained or disposed of consistent with 
Federal statutes and regulations.
    1.12. Publication and Release of Documents. The EAC will release 
documents consistent with the requirements of Federal law. It is EAC 
policy to make the laboratory accreditation process as open and public 
as possible. Any documents (or portions thereof) submitted under this 
program will be made available to the public unless specifically 
protected from release by law. The primary means for making this 
information available is through the EAC Web site. See Chapter 7 of 
this Manual for additional information.
    1.13. References. The following documents are referenced in this 
Manual. For dated references, only the edition cited applies. For 
undated references, the latest edition of the referenced document 
(including any amendments) applies.

--ISO/IEC 17011, Conformity assessment--General requirements for 
accreditation bodies accrediting conformity assessment bodies.
--ISO/IEC 17025, General requirements for the competence of testing and 
calibration laboratories.
--NIST Handbook 150, (NVLAP) Procedures and General Requirements.
--NIST Handbook 150-22, (NVLAP) Voting System Testing.

    1.14. Definitions. For purposes of this Manual, the terms listed 
below have the following definitions.
    Applicant Laboratory. An independent, non-Federal laboratory which 
has applied for EAC accreditation after receipt of an invitation.
    Commission. The U.S. Election Assistance Commission, as an agency.
    Commissioners. The serving commissioners of the U.S. Election 
Assistance Commission.
    Contracted Third Party Laboratory. A laboratory contracted or 
otherwise providing testing services to a VSTL to meet program 
requirements.
    Days. Calendar days, unless otherwise noted. When counting days, 
for the purpose of submitting or receiving a document, the count shall 
begin on the first full calendar day after the date the document was 
received.

[[Page 50145]]

    Election Official. A State or local government employee who has as 
one of his or her primary duties the management or administration of a 
Federal election.
    Federal Election. Any primary, general, runoff, or special Election 
in which a candidate for Federal office (President, Senator, or 
Representative) appears on the ballot.
    Fielded Voting System. A voting system purchased or leased by a 
State or local government that is being use in a Federal election.
    Gift. A Gift includes any gratuity, favor, discount, entertainment, 
travel, service, hospitality, loan, meal, forbearance, or other item 
having monetary value.
    Integration Testing. The end-to-end testing of a full system 
configured for use in an election to assure that all legitimate 
configurations meet applicable standards.
    Key Laboratory Staff. Laboratory employees serving as approval 
authorities of test reports (approved signatories per NIST Handbook 
150) or otherwise responsible for the supervision of individuals 
performing voting system testing.
    Lead Voting System Test Laboratory. The accredited Voting System 
Test Laboratory identified on an EAC approved Application for Testing 
(EAC Voting System Testing and Certification Program Manual, Sec. 4.3, 
Certification Application).
    Manufacturer. The entity with ownership and control over a voting 
system submitted for certification.
    Memorandum for the Record. A written statement drafted to document 
an event or finding, without a specific addressee other than the 
pertinent file.
    Proprietary Information. Commercial information or trade secrets 
protected from release under the Freedom of Information Act (FOIA) and 
the Trade Secrets Act.
    Recommended Laboratory. A laboratory recommended for EAC 
accreditation by the Director of NIST after evaluation by NVLAP.
    Scope of Accreditation. The version or versions of the Federal 
voting system standards (VSS or VVSG) to which a VSTL is authorized to 
test.
    Technical Reviewers. Technical experts in the areas of voting 
system technology and conformity assessment appointed by the EAC to 
provide expert guidance.
    Testing and Certification Decision Authority. The EAC Executive 
Director or Acting Executive Director.
    Testing and Certification Program Director. The individual 
appointed by the EAC Executive Director to administer and manage the 
Testing and Certification Program.
    Voting System. The total combination of mechanical, 
electromechanical, and electronic equipment (including the software, 
firmware, and documentation required to program, control, and support 
the equipment) that is used to define ballots, cast and count votes, 
report or display election results, interface the voting system to the 
voter registration system, and maintain and produce any audit trail 
information.
    Voting System Standards. Voluntary voting system standards 
developed by the FEC. Voting System Standards have been published 
twice: once in 1990 and again in 2002. The Help America Vote Act made 
the 2002 Voting System Standards EAC guidance. All new voting system 
standards are issued by the EAC as Voluntary Voting System Guidelines.
    Voting System Test Laboratories (VSTLs). Laboratories accredited by 
the EAC to test voting systems to EAC approved voting system standards.
    Voluntary Voting System Guidelines. Voluntary voting system 
standards developed, adopted, and published by the EAC. The guidelines 
are identified by version number and date.
    1.15. Acronyms and Abbreviations. For purposes of this Manual, the 
acronyms and abbreviations listed below represent the following terms.
    Accreditation Program. The EAC Voting System Test Laboratory 
Accreditation Program
    Certification Program. The EAC Voting System Testing and 
Certification Program
    EAC. United States Election Assistance Commission
    FEC. Federal Election Commission
    HAVA. Help America Vote Act of 2002 (42 U.S.C. Sec.  15301 et seq.)
    ISO/IEC. The International Organization for Standardization & The 
International Electrotechnical Commission
    NASED. National Association of State Election Directors
    NIST. National Institute of Standards and Technology
    NVLAP. National Voluntary Laboratory Accreditation Program
    Program Director. Director of the EAC Testing and Certification 
Program
    VSS. Voting System Standards
    VSTL. Voting System Test Laboratory
    VVSG. Voluntary Voting System Guidelines

2. Program Requirements

    2.1. Overview. This chapter lists the requirements of the EAC's 
Voting System Test Laboratory Program. Adherence to these requirements 
is a condition of accreditation and a continuing obligation. Failure to 
demonstrate compliance with the requirements of this chapter may result 
in the denial of an application for accreditation, suspension of 
accreditation, or revocation of accreditation.
    2.2. Program Requirements--Generally. In order to be considered 
for, receive, and maintain an EAC accreditation as a VSTL, laboratories 
must demonstrate compliance with the requirements of EAC's Voting 
System Test Laboratory Program. The program requirements are set forth 
in this Chapter.
    2.2.1. Continuing Compliance Obligation. VSTLs have a continuing 
obligation to meet the requirements set forth in this Chapter. VSTLs 
are required to maintain their compliance with the program's 
requirements as long as they hold an EAC accreditation.
    2.2.2. Requests to Document Compliance. VSTLs may be required by 
the EAC to document compliance at any time. Such requests will be in 
writing and VSTLs shall respond timely, consistent with the request 
(see Chapter 4 of this Manual).
    2.2.3. Failure to Comply, Effect. Failure to meet each of the 
program's requirements may result in the denial of an application for 
accreditation, suspension of accreditation, or revocation of 
accreditation, consistent with the procedures of Chapter 5 of this 
Manual.
    2.3. NIST Recommendation. As a condition of accreditation, all 
laboratories must be recommended to the EAC by the National Institute 
of Standards and Technology (NIST), unless the emergency provisions of 
Chapter 3 apply. NIST is responsible, pursuant to the Help America Vote 
Act of 2002, Section 231(b), for performing a technical evaluation of 
laboratories and identifying and recommending those competent to test 
voting systems. This recommendation is provided directly to the EAC 
from NIST.
    2.4. NVLAP Accreditation. As a condition of accreditation, all 
VSTLs must hold a valid accreditation from NIST's National Voluntary 
Laboratory Accreditation Program (NVLAP), unless the emergency 
provisions of Chapter 3 apply. NVLAP accreditation is the primary means 
by which the EAC may ensure that each VSTL meets and continues to meet 
the technical requirements of the EAC program. It sets the standards 
for each of VSTL's technical, physical, and personnel resources, as 
well as its testing, management, and quality assurance policies and 
protocols. The loss or

[[Page 50146]]

suspension of a NVLAP accreditation will result in the suspension and 
possible revocation of any EAC accreditation consistent with the 
procedures of Chapter 5 of this Manual. VSTLs are required to 
immediately report any change in their NVLAP accreditation status to 
the EAC.
    2.5. Conflict of Interest and Prohibited Practices Program. As a 
condition of accreditation, all laboratories must maintain and enforce 
policies which prohibit and prevent conflicts of interest or the 
appearance of conflicts of interest. A laboratory shall ensure that 
neither the Laboratory, its parent corporation, contracted third party 
laboratories, nor any individual staff member involved in the testing 
of voting systems have any vested interest in the outcome of the test 
process. Laboratories must have a written policy in place. This policy 
must, at a minimum, (1) prohibit conflicts of interest and other 
prohibited practices and (2) provide for enforcement, consistent with 
the subsections below.
    2.5.1. Prohibited Conflicts of Interest. The purpose of a conflict 
of interest policy is to prevent situations where the exercise of an 
official duty directly impacts the actor's financial interests. For the 
purposes of this program, a prohibited conflict of interest exists if 
the duties and responsibilities of a laboratory, parent corporation, or 
a laboratory employee involved in the testing of voting systems under 
EAC's Certification Program will have a direct and predictable effect 
on the financial interest of that laboratory, parent corporation, or a 
laboratory employee.\1\ For example, an employee who is responsible for 
testing a voting system on behalf of a VSTL would be prohibited from 
holding a financial interest in the entity whose product is being 
tested or a direct competitor of that entity. A prohibited conflict of 
interest would also include a contractual or other fiduciary 
relationship between a VSTL or VSTL employee and a Manufacturer 
(outside an agreement for State or Federal certification testing) when 
that VSTL or VSTL employee is concurrently responsible for conducting 
certification testing for that Manufacturer under this program. 
Additionally, financial interests may be imputed or attributed to a 
laboratory, parent corporation, or a laboratory employee through a 
relationship with a third party. For example, a VSTL employee 
responsible for the testing of a voting system would be conflicted from 
performing his or her duties if his or her spouse owned a financial 
interest in the manufacture of the voting system.
---------------------------------------------------------------------------

    \1\ For the purpose of this Program, agreements with voting 
system manufacturers to provide testing pursuant to the requirements 
of EAC or a State's certification program do not constitute a 
prohibited conflict of interest. Certification testing is considered 
a duty and responsibility of a VSTL, not an outside financial 
interest.
---------------------------------------------------------------------------

    2.5.1.1. Involved in Testing--Defined. For the purposes of a 
financial conflict of interest, an organization is involved in the 
testing of a voting system any time it contractually or otherwise takes 
on the responsibility for testing a voting system to Federal standards 
under EAC's Certification Program. For the purposes of a financial 
conflict of interest, an employee is involved in the testing of a 
voting system when the individual's duties as a VSTL employee require 
him or her to perform testing on the system, manage the testing process 
or supervise those who perform testing on the system.
    2.5.1.2. Financial Interest--Defined. The term includes any current 
or contingent ownership, equity, or security interest in real or 
personal property or a business and may include an indebtedness or 
compensated employment relationship. It thus includes, for example, 
interests in the nature of stocks, bonds, partnership interests, fee 
and leasehold interests, and other property rights, deeds of trust, and 
liens, and extends to any right to purchase or acquire any such 
interest, such as a stock option or commodity future.
    2.5.1.3. Direct Effect--Defined. A matter will have a direct effect 
on a financial interest if there is a close causal link between any 
decision or action to be taken in the matter and any expected effect of 
the matter on the financial interest. An effect may be direct even 
though it does not occur immediately. A matter will not have a direct 
effect on a financial interest, however, if the chain of causation is 
attenuated or is contingent upon the occurrence of events that are 
speculative or that are independent of, and unrelated to, the matter. A 
matter that has an effect on a financial interest only as a consequence 
of its effects on the general economy does not have a direct effect 
within the meaning of this section.
    2.5.1.4. Predictable Effect--Defined. A matter will have a 
predictable effect if there is a real, as opposed to a speculative 
possibility that the matter will affect the financial interest. It is 
not necessary, however, that the magnitude of the gain or loss be 
known, and the dollar amount of the gain or loss is immaterial.
    2.5.1.5. Imputed Interests--Defined. An imputed interest is a 
financial interest held by a third party individual or organization 
that serves to disqualify an employee or laboratory to the same extent 
as if they were the employee's or laboratory's own interest. These 
interests include:
    2.5.1.5.1. The financial interests of a spouse or dependent child 
shall be imputed to an employee.
    2.5.1.5.2. The financial interest of any organization in which a 
laboratory, parent corporation, or a laboratory employee serves as an 
employee, officer, board member, partner, consultant, director, trustee 
or similar position shall be imputed.
    2.5.1.5.3. The interests of any contracted third party laboratory 
shall be imputed to the utilizing VSTL.
    2.5.1.5.4. The financial interest of a person or organization with 
whom an employee is negotiating or has an arrangement concerning 
prospective employment shall be imputed.
    2.5.2. Prohibited Practices. Furthermore, irrespective of the 
existence of a conflict of interest, it is a prohibited practice for a 
laboratory, parent corporation, or laboratory employee to be involved 
in the development of a voting system or solicit or receive a gift from 
a voting system Manufacturer. No laboratory, parent corporation, or 
laboratory employee may:
    2.5.2.1. Voting System Development and Testing. Provide, or have 
provided, consultation, developmental testing or other services to a 
voting system developer such that the independence, or appearance of 
independence, in the testing of a particular voting system or system 
component would be compromised.
    2.5.2.1.1. A laboratory or individual may not be involved in both 
the development of a voting system and the certification of a system. 
Voting system development includes any testing, consultation or design 
work performed in order to ready a specific system for the marketplace 
or the certification process. Generally, any testing performed on 
behalf of a voting system manufacture that was not otherwise performed 
pursuant to a State or Federal voting system certification program will 
be considered developmental in nature.
    2.5.2.1.2. The prohibition barring participation in both 
development and testing is voting system specific. An employee or 
laboratory that was previously involved \2\ in product development with 
a Manufacturer is not

[[Page 50147]]

prohibited from testing all systems produced by that Manufacturer, just 
those systems in which the employee or laboratory participated directly 
in development. As voting systems are subject to change over time, for 
the purposes of this prohibition, a voting system shall be considered 
altered to the degree that it is a different system when:
---------------------------------------------------------------------------

    \2\ The prohibition relates to a VSTL's prior involvement in 
system development. Concurrent development work and testing may 
constitute a prohibited conflict of interest under Section 2.5.2 of 
this Manual.
---------------------------------------------------------------------------

    2.5.2.1.2.1. A period of at least three years has passed since the 
VSTL or employee was involved in the system's development;
    2.5.2.1.2.2. The system has been subject to both software and 
hardware modification since the VSTL or employee was involved in the 
system's development. De minimis changes (as defined in EAC Voting 
System Testing and Certification Program Manual) are not modifications; 
AND
    2.5.2.1.2.3. The system has received a certification after being 
tested by a different independent laboratory since the VSTL or employee 
was involved in the system's development.
    2.5.2.1.3. The prohibition barring participation in both 
development and testing does not prohibit a VSTL from allowing a 
Manufacturer to perform onsite hardware mitigation on a voting system 
in response to a minor system failure or anomaly. In such cases the 
VSTL:
    2.5.2.1.3.1. Shall suspend all hardware testing;
    2.5.2.1.3.2. Shall not participate or assist the Manufacturer in 
remediation;
    2.5.2.1.3.3. May provide testing equipment and qualified operators 
to the Manufacturer for its use;
    2.5.2.1.3.4. Shall monitor and document the Manufacturer's access 
to the system consistent with Section 2.11.1. of this manual; and
    2.5.2.1.3.5. Shall document in the test report the failure or 
anomaly and remedial action taken by the Manufacturer consistent with 
Section 2.10.5.2.1 of this Manual and Chapter 4 of EAC's Certification 
Manual (anomaly matrix).
    2.5.2.2. Gifts. Solicit or receive a gift, directly or indirectly, 
from any entity which holds a financial interest in the development, 
production, or sale of voting systems, or is otherwise impacted by the 
testing and certification of voting systems. Gifts given or received 
under circumstances which make it clear that the gift is motivated by a 
family relationship or personal friendship rather than position are not 
prohibited. Relevant factors in making such a determination include the 
history of the relationship and whether the family member or friend 
personally pays for the gift.
    2.5.3. Program Enforcement Elements. Prohibited conflicts and 
practices shall be enforced through a written program which:
    2.5.3.1. Regarding Employees Involved in the Testing of Voting 
Systems.
    2.5.3.1.1. Annually collects standard information from each 
employee, including assets, debts, outside or prior activities/
employment, gifts, and any work on voting system development sufficient 
to demonstrate compliance with Section 2.5.1. and 2.5.2. of this 
Manual. The information collection must also reflect the financial 
interests of those individuals (like spouses and minor children) whose 
interests are imputed to the employee;
    2.5.3.1.2. Requires and documents the review of information 
collected for potential conflicts and prohibited practices; and
    2.5.3.1.3. Resolves all identified conflicts of interest or 
prohibited practices prior to the employee or laboratory's involvement 
in the testing of any voting system. Such resolution shall be 
documented. Resolutions may include the divestiture of assets or gifts, 
employee resignation from outside organizations, or the altering of an 
employee's responsibilities by prohibiting participation in Voting 
System Testing or the testing of a specific system.
    2.5.3.2. Regarding the VSTL or VSTL's Parent Corporation.
    2.5.3.2.1. Annually collects information pertaining to the holdings 
and activities of the VSTL and its parent corporation(s), sufficient to 
demonstrate compliance with Section 2.5.1. and 2.5.2. of this Manual;
    2.5.3.2.2. Requires and documents the review of collected 
information for potential conflicts and prohibited practices; and
    2.5.3.2.3. Resolves all identified conflicts of interest or 
prohibited practices prior to the laboratory's testing of any voting 
system. Such resolution shall be documented. Resolutions may include 
the divestiture of assets or gifts, the termination or rejection of 
conflicted or prohibited testing work.
    2.5.3.3. Regarding Contracted Third Party Laboratories. The 
interest of a contracted third party laboratory may be imputed to a 
VSTL. VSTLs may meet and enforce the program requirements of this 
section with regard to this relationship in one of two ways:
    2.5.3.3.1. Collection of third party laboratory information, review 
of information and resolution of conflicts or prohibited practices:
    2.5.3.3.1.1. Collect information pertaining to the holdings and 
activities of the third party laboratory and its employees, sufficient 
to demonstrate compliance with Section 2.5.1. and 2.5.2. of this 
Manual. This includes gathering information concerning any involvement 
by the third party laboratory or its employees in the development of 
specific voting systems. This collection of information shall be 
performed prior to the execution of any contract for the testing of 
voting systems under this program and annually thereafter if the 
contract exceeds one year in duration.
    2.5.3.3.1.2. Require and document the review of collected 
information for potential conflicts, and
    2.5.3.3.1.3. Resolve all identified conflicts of interest prior to 
the laboratory's testing of any voting system.
    2.5.3.3.2. VSTL Supervision of third party laboratories performing 
non-core testing. Where a third party laboratory is subject to direct 
VSTL supervision and observation, the third party laboratory's 
conflicts of interest or prohibited practices will not be imputed to 
the lead VSTL. Direct VSTL supervision under this section requires that 
a VSTL employee is physically present during the third party testing 
and directly observes and supervises the testing. This VSTL employee 
must: (1) have been properly vetted for conflict of interest and 
prohibited practices pursuant to Section 2.5 of this Manual, (2) be 
competent to supervise the testing being performed and (3) have no 
financial interest in the third party laboratory they are supervising.
    2.5.4.  Waivers. In rare circumstances, prohibited practices or 
conflicts of interest may be waived by the EAC after the conflict or 
prohibited practice is properly disclosed to the agency. Waivers may be 
granted at the sole discretion of the Program Director.
    2.5.4.1. Requesting a Waiver. A request for a waiver shall be made 
in writing to the EAC Program Director. The request shall fully 
disclose the conflict of interest or prohibited practice for which the 
waiver is sought. The request shall also describe all steps taken to 
resolve the conflict or prohibited practice and the reasons why such 
attempts were unsuccessful or otherwise untenable. The request shall 
also state why the waiver should be granted, consistent with the 
standard in Section 2.5.4.2.
    2.5.4.2. Waiver Standard. A disqualifying conflict of interest or 
prohibited practice is subject to waiver when the issuance of a waiver 
is in the best interest of the EAC Certification Program and the 
identified conflict or practice is unlikely to affect the integrity

[[Page 50148]]

or impartiality of the VSTL or VSTL employee's services under the EAC 
Certification Program. The Program Director may consider the following 
factors in making a waiver determination:
    2.5.4.2.1. The value of any disqualifying financial interest;
    2.5.4.2.2. The nature and impact of any prohibited practice;
    2.5.4.2.3. The role and responsibility of the employee subject to 
the conflict of interest or prohibited practice;
    2.5.4.2.4. The availability of other employees, VSTLs or 
laboratories to conduct the testing without a conflict or prohibited 
practice.
    2.5.4.2.5. The level of discretion or sensitivity required to 
perform the conflicted or prohibited duties under the certification 
program;
    2.5.4.2.6. The ability of an EAC waiver to adjust a VSTL or VSTL 
employee's testing process and duties or otherwise mandate additional 
safeguards which would limit or abrogate the impact of the conflict of 
interest or prohibited practice.
    2.5.4.3. Issuing a Waiver. Any waiver issued by the Program 
Director shall be made in writing to the requestor. The waiver shall 
state with specificity the conflict of interest or prohibited practice 
waived. The waiver shall also clearly state any conditions for its 
issuance, such as mitigating processes or procedures or safeguards. The 
VSTL is responsible for meeting all waiver conditions prior to engaging 
in the waived activity. Failure to meet such condition may result in 
the revocation of a VSTLs accreditation. The Program Director shall 
publish all waivers on the EAC Web site.
    2.5.4.4. Denying a Request for a Waiver. Any decision denying a 
request for a waiver shall be made by the Program Director in writing 
and provided to the VSTL. The Program Director shall publish all waiver 
denials on the EAC Web site.
    2.6. Personnel Policies. As a condition of accreditation, all 
laboratories shall have in place written policies to ensure that the 
Laboratory does not employ individuals, in any capacity related to the 
testing of voting systems, who have been convicted of a felony offense 
or any criminal offense involving fraud, misrepresentation, or 
deception under either Federal or State law. The VSTL shall have a 
program in place to enforce this policy and document such enforcement.
    2.7. Notification of Changes. As a condition of accreditation, all 
laboratories shall agree to notify the EAC in writing within fifteen 
(15) calendar days of any significant changes in laboratory operations 
from what the Laboratory described in any assertion that served as the 
basis for its EAC accreditation, including any assertions made to 
NIST's NVLAP or to the EAC pursuant to Chapter 3 of this Manual. 
Examples of events that require written notification include, but are 
not limited to:
    2.7.1. A Laboratory's decision to withdraw from the EAC's program;
    2.7.2. Changes in ownership of the Laboratory (other than minor-
less that 15%-change in stock ownership),
    2.7.3. A change in location of the Laboratory facility, or
    2.7.4. Personnel changes in key staff positions.
    2.8. Site Visits. As a condition of accreditation, all laboratories 
shall allow EAC representatives to enter their voting system testing 
and management facilities pursuant to the procedures and requirements 
of Chapter 4 of this Manual.
    2.9. Notice of Lawsuits. As a condition of accreditation, all 
laboratories shall provide notice to the EAC of any lawsuits or claims 
filed against it, its subcontractors, subsidiaries, employees, 
officers, owners, operators, or insurers while the Laboratory holds an 
EAC accreditation and which relate to the work performed in, or 
management of, the Laboratory's voting system testing program.
    2.10. Testing, Technical Practices and Reporting. As a condition of 
accreditation, each VSTL shall perform testing in conformance with the 
relevant standards of the applicable Federal Standards (VVSG or VSS). 
Additionally, the VSTL shall create written reports of such testing 
consistent with the requirements of the latest version of the VVSG, 
EAC's Voting System Testing and Certification Manual, any applicable 
test suites mandated by the EAC, and any other written guidance 
published by the EAC.
    2.10.1. Test Plan Package. The VSTL shall submit a test plan 
package directly to the EAC consistent with the requirements of the 
Voting System Testing and Certification Manual, the latest version of 
the VVSG, this Manual and any other written guidance from the EAC. A 
test plan package includes:
    2.10.1.1. Requirements Matrix. The Requirements Matrix is a form 
developed by the EAC which identifies each requirement found in Federal 
voting system standards (a version of the VVSG or VSS). VSTLs will be 
required to identify the standards that apply to the system being 
tested, identify the testing to be performed and provide additional 
information as required. The Requirements Matrix and instructions for 
its completion may be found on EAC Web site at www.eac.gov. The matrix 
will serve as both a tool to identify and a means to document what 
should be tested and how.
    2.10.1.2. Test Plan. The purpose of the Test Plan is to provide 
information regarding test methods. The Test Plan contains more detail 
than the Requirements Matrix.
    2.10.1.2.1. Format. VSTLs shall format each test plan consistent 
with the requirements of Appendix A of this Manual.
    2.10.1.2.2. Content. Each test plan shall identify applicable 
voting system standards and contain a description of the testing 
proposed to verify conformance. Also, each test plan shall contain a 
statement indicating the scope of the labs accreditation.
    * Required Content. For each test, the test plan shall provide 
detailed information referencing testing to be performed, including 
facility requirements, test set-up, test sequence, data recording 
requirements and pass criteria.\3\
---------------------------------------------------------------------------

    \3\ This requirement is consistent with International Standards 
Organization requirements, which serve as a basis for NIST NVLAP's 
accreditation and recommendation to the EAC. Where established and 
approved test methods do not exist, ISO Standard 17025, Section 
5.4.4., Non-Standard Method requires the testing to be validated by 
the laboratory prior to use. The EAC will review and approve the 
validated test methods.
---------------------------------------------------------------------------

    * Exception. Where a VSTL utilizes EAC mandated or approved test 
methods, the test plan may simply reference these methods and identify, 
with specificity, all deviations. Mandated test methods are those test 
methods required for use by the EAC. Approved test methods are 
standard, verified VSTL test methods approved by the EAC. VSTLs may 
submit standard test methods for approval by submitting them in writing 
to the Program Director.
    2.10.2. Test Case. After approval of the VSTLs Test Plan, the VSTL 
shall develop Test Cases. A Test Case is a system specific, step-by-
step test procedure or laboratory testing process that provides 
detailed test operation procedures sufficient for trained laboratory 
personnel to fully conduct a given test and produce repeatable results. 
The VSTL shall inform the EAC, in writing, when all test cases for the 
voting system under test have been completed. This notice shall include 
an index identifying each test case created to test the system. The 
notification should indicate if these are standard test cases, modified 
standard test cases, or a new test case. These test cases shall be 
available to the EAC for review and approval upon request.

[[Page 50149]]

    2.10.3. Testing. The highest standards shall be applied to the 
testing of voting systems. VSTLs shall perform testing in conformance 
with the relevant standards of the applicable Federal Standards (VVSG 
or VSS) and consistent with any written EAC interpretations of these 
standards. The Laboratory shall maintain its technical practices 
consistent with the standards which served as the basis for its NVLAP 
accreditation. These standards include International Standard ISO/IEC 
17025, General Requirements for the Competence of Testing and 
Calibration Laboratories; NIST Handbook 150, Procedures and General 
Requirement; NIST Handbook 150-22, Voting System Testing; any documents 
supplementing, updating or replacing these standards or handbooks; and 
any pertinent EAC guidance. When conducting testing under EAC's 
program, VSTLs shall only perform testing of voting systems consistent 
with the scope of their accreditation.
    2.10.4. Third Party Testing. Lead VSTL's may contract or otherwise 
provide for the testing of voting systems by third parties under this 
program. However, the lead VSTL shall be responsible for the accuracy, 
quality assurance, and results of all tests performed. Under this 
program, no VSTL may perform or contract for the performance of testing 
outside the scope of its accreditation. Testing performed directly by 
lead VSTL personnel using third party contractor equipment and 
facilities is not considered third party testing.
    2.10.4.1. Core Testing. Core voting system testing may only be 
performed by VSTLs. Therefore, a VSTL may only contract or otherwise 
provide for the core testing of voting systems if it uses a third party 
VSTL. Core testing includes: Technical Data Package review, physical 
configuration audit, source code review, functional configuration 
audit, system integration testing, volume testing, and security testing 
(not including cryptographic testing).
    2.10.4.2. Non-Core Testing. Non-core testing may be performed by 
non-VSTLs if they hold an EAC recognized accreditation to perform the 
relevant testing. The EAC recognizes two national accreditation bodies, 
NIST's NVLAP program and the American Association of Laboratory 
Accreditation (A2LA). Generally, a VSTL may only contract or otherwise 
provide for the non-core testing of voting systems if it uses a NVLAP 
or A2LA laboratory accredited to the specific scope of testing 
necessary. Non-core testing includes: Electromagnetic compatibility 
testing, telecommunications testing, environmental testing, electrical 
testing, acoustical testing, and cryptographic testing.\4\ In limited 
circumstances, laboratories not holding a recognized accreditation may 
be used by VSTLs for non-core testing only after approval by EAC's 
Program Director. Requests for such approval must be made in writing 
and demonstrate: (1) That there is no recognized laboratory available 
within a reasonable window of availability and geographic proximity 
(generally within the continental United States) and (2) that the VSTL 
has conducted a thorough assessment of the third party laboratory's 
capabilities, quality system, management system, and/or alternative 
accreditations and have determined and documented that the laboratory 
is qualified to perform testing. The EAC may visit, interview or audit 
any non-accredited laboratory at any time before, during, or after the 
testing has occurred to verify their qualifications.
---------------------------------------------------------------------------

    \4\ For the purposes of the EAC's Voting System Test Laboratory 
Program, non-core cryptographic testing includes all testing 
involving evaluation of cryptographic operation and key management.
---------------------------------------------------------------------------

    2.10.4.3. VSTL Responsibilities. Lead VSTLs are responsible for all 
tests performed on voting systems submitted to them by Manufacturers 
under EAC's Testing and Certification Program. This includes testing 
(both core and non-core) performed by third party laboratories under 
their direction (including third party VSTL laboratories). Any 
procedural or substantive irregularities or errors which occur during 
the third party testing process will be imputed to the responsible lead 
VSTL. Such failures may serve as a basis for the revocation of 
accreditation. Lead VSTLs using third party laboratories (consistent 
with Sections 2.10.4.1 through 2.10.4.2, above) shall take steps to 
ensure that the third party laboratories they employ meet the standards 
of this Program. At a minimum, the lead VSTLs shall ensure:
    2.10.4.3.1. The third party laboratory provides the lead VSTL 
verifiable documentation regarding its relevant accreditation;
    2.10.4.3.2. Any hardware tested by the qualified third party 
laboratory is first validated by the lead VSTL as the same hardware 
presented to it for certification;
    2.10.4.3.3. The third party laboratory provides the lead VSTL with 
evidence that it will direct its activities in compliance with any and 
all relevant VVSG requirements for testing and that the testing was, in 
fact, performed consistent with such specific requirements. Any special 
procedures, tools, or testing software necessary to meet VVSG 
requirements must be validated by the lead VSTL prior to use. For 
example, the VVSG requires that systems be tested while operating and 
that such operation be in a manner and under conditions that simulate 
election use. In such cases, the lead VSTL must ensure that the third 
party laboratory will properly implement the VVSG requirements, 
validate its election simulation tools, and properly performed the 
testing;
    2.10.4.3.4. The lead VSTL performs all system accuracy, 
reliability, functionality and integration testing; and
    2.10.4.3.5. The third party laboratory issues a report to the lead 
VSTL that fully documents its testing such that the lead VSTL may 
demonstrate compliance with this section and produce a report 
consistent with Section 2.10.5 of this Manual.
    2.10.5. Test Report Package. The Test Report Package represents the 
culmination of the testing process. As such, it is vital that it 
accurately and completely document the testing performed and the 
results of such testing. VSTLs shall submit Test Report Packages 
directly to the EAC. The packages shall include:
    2.10.5.1. Requirements Matrix. VSTLs shall complete the 
requirements matrix originally submitted with its test plan (see 
Section 2.10.1 above). The Requirements Matrix and instructions for its 
completion may be found on the EACs Web site at www.eac.gov. The final 
submission of the Requirements Matrix will serve as verification that 
the VSTL performed the testing required to demonstrate compliance with 
voting system standards.
    2.10.5.2. Test Report. VSTLs shall provide a test report.
    2.10.5.2.1. Content. All test reports shall document the testing 
process, including the documentation and justification of any 
divergence from the EAC approved test plan, methods, or cases and the 
identification of all failures and/or anomalies along with any remedial 
action taken \5\ (see Chapter 4 of the EAC's Voting System Testing and 
Certification Manual regarding the anomaly matrix). Test reports shall 
also document any prescribed maintenance or modifications, performed by 
the Manufacturer, to a voting system in testing. Such maintenance or 
modifications shall be monitored by the

[[Page 50150]]

VSTL consistent with Section 2.11.1 of this Manual.
---------------------------------------------------------------------------

    \5\ VSTLs must report all errors and anomalies identified in the 
test campaign even when an error is identified during the testing of 
unrelated functionality.
---------------------------------------------------------------------------

    2.10.5.2.2. Format. To the greatest extent possible, VSTLs shall 
write reports such that they are understandable to non-technical 
persons. As the EAC will publish these reports (bar portions prohibited 
by law), VSTLs shall refrain from including in them trade secrets or 
other commercial information protected from release unless 
substantively required. Where information protected from release may be 
included, it shall be identified consistent with Chapter 7 of this 
Manual. VSTLs shall format each test report consistent with the 
requirements of Appendix B of this Manual.
    2.10.5.3. VSTL Attestation. The VSTL shall provide a letter, signed 
by a representative authorized to take action on behalf of the VSTL 
(see Sections 2.13 and 3.4.1.6. of this Manual), which attests that (1) 
all testing prescribed by the test plan or amended test plan was 
performed as identified or the divergence from the test plan was 
properly documented, (2) all identified voting system anomalies or 
failures were reported and resolved, (3) that the test report is 
accurate and complete, and (4) the VSTL recommends the system for 
certification.
    2.10.6. Acceptance of Prior Testing. Generally, a valid test 
previously performed on a voting system by a VSTL, or by a third party 
test laboratory operating at the direction of a VSTL, may be reused at 
the discretion of the lead VSTL. The EAC encourages VSTLs to use such 
testing to fulfill current certification requirements. The EAC will 
accept prior testing only when the below requirements are met. Lead 
VSTLs are responsible for ensuring that the prior testing has met these 
requirements. Prior testing is valid when:
    2.10.6.1. The discrete software or hardware component previously 
tested is demonstrably identical to that presently offered for testing. 
Lead VSTLs must examine the components to ensure no change has taken 
place consistent with all documentation. When valid prior testing is 
used, the system presented must be subject to regression testing, 
functional testing and system integration testing;
    2.10.6.2. The voting system standards and relevant EAC 
interpretations applicable to the prior and current testing are 
identical;
    2.10.6.3. The test methods used are equivalent or identical to 
current test methods approved by the EAC;
    2.10.6.4. The prior testing has been reviewed by the VSTL and no 
errors or omissions are apparent. Any errors or omissions identified 
shall be reported to the EAC; and
    2.10.6.5. The adoption and use of prior testing is noted in the 
test plan and test report. Like all testing, prior testing is subject 
to EAC review and approval.
    2.10.7. Termination of Testing Prior to Completion. In the event 
testing is terminated prior to completion, VSTLs are required to notify 
the EAC Program Director. This notification shall be in writing and 
state the reasons for termination, provide a list of all testing 
completed, and produce a matrix of test anomalies or failures pursuant 
to Section 4.5.2 of the EAC Testing and Certification Program Manual.
    2.10.7.1. Termination Defined. Voting system testing shall be 
considered terminated when the testing process is permanently ended or 
otherwise halted without a specific plan to recommence within 180 days 
of the last test performed.
    2.10.7.2. Effect of Termination. Notification of termination will 
result in the suspension of the Manufacturer's Certification 
Application. Additionally, the termination and VSTL's written notice 
shall be posted on EAC's Web site.
    2.10.7.3. Resubmission after Termination. Manufacturers may 
resubmit a system previously terminated by submitting an updated 
application consistent with Chapter 4 of the Voting System Testing and 
Certification Program Manual. Pursuant to Section 2.11 of this Manual 
and Section 4.3.1.2 of the Voting System Testing and Certification 
Program Manual, a system resubmitted to the EAC after termination must 
be tested by the VSTL identified on the original application.
    2.11. Laboratory Independence. As a condition of accreditation, all 
laboratories shall maintain their independence from voting system 
Manufacturers, consistent with their roles and responsibilities as a 
key component of the EAC Certification program. VSTLs shall maintain an 
arm's length relationship with the manufacturers and avoid even the 
appearance of improper conduct. In order to maintain independence, 
VSTLs shall adhere to the following independence principles and 
requirements:
    2.11.1. Testing Independence. Consistent with the requirements of 
this Manual, only the lead VSTL identified on a voting system's 
application form may test or oversee the testing of that system. Under 
no circumstances may a Manufacturer perform or participate in any 
testing which will serve as the basis of an EAC certification. 
Participation includes but is not limited to the observation of testing 
by the Manufacturer.\6\ Additionally, lead VSTL's shall ensure that 
Manufactures' do not have access to a system under test unless 
accompanied and monitored by a VSTL representative.
---------------------------------------------------------------------------

    \6\ Not all activities required for EAC Certification are 
``testing'' activities. Examples of certification requirements that 
do not fall into the category of ``testing'' include trusted and 
witness builds.
---------------------------------------------------------------------------

    2.11.2. Decision Making. Determinations regarding testing, test 
requirements, and test results shall be made on the basis and for the 
purpose of ensuring that the systems tested meet Federal voting system 
standards. A VSTL's primary purpose shall be to serve the public 
interest through adherence to the EAC Testing and Certification 
Program.
    2.11.3. Single Laboratory Requirement. EAC's Testing and 
Certification Program prohibits Manufacturers from changing 
laboratories during the testing process. Once a lead VSTL is identified 
to the EAC by the Manufacturer to test a system, a test report will not 
be accepted by the EAC from any other laboratory unless authorized 
pursuant to Chapter 4 of the EAC's Voting System Testing and 
Certification Program Manual. This strict policy supports VSTLs in 
their independent decision making role. VSTLs shall immediately report 
to the EAC Certification Program Director any time a Manufacturer 
withdraws a product from testing or the testing is otherwise terminated 
(see Section 2.10.7. of this Manual).
    2.11.4. Fee for Service. All fees paid by a Manufacturer to a VSTL 
shall be solely for services rendered. No payment may be accepted by a 
VSTL that is not directly linked to services necessary to complete 
system testing. No payment may be accepted by a VSTL that is 
conditioned or dependent on testing outcome.
    2.11.5. Written Communications. To ensure and document the 
independent relationship between test laboratories and Manufacturers, 
all substantive discussions regarding the outcome, cost, payment and 
testing of a voting system shall be conducted or otherwise documented 
in writing by the VSTL. These records shall be maintained consistent 
with Section 2.15 of this Manual. Examples of substantive discussions 
between the lead VSTL and a Manufacturer include but are not li